1. I have never done an upgrade this far apart... but my guess would be that IOS will be fine (or mostly fine), but I would be really surprised if you did not have CUE issues.
2. Officially -- no (only SPA525G is supported for SSL VPN). Unofficially? I have seen some posts suggesting that it is possible, but have not tried it myself.
3. Officially -- none. Unofficially? Any standards compliant SIP phone can be used if you configure it in command line. Though the functionality may be limited in some ways that SCCP phones are not.
-Dan
Please rate useful posts.